Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

Analysis

  • max time kernel
    1195s
  • max time network
    1169s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    14/04/2024, 11:58

General

  • Target

    inf.exe

  • Size

    1.3MB

  • MD5

    73dea1a75637e14f6fcd012fe2815636

  • SHA1

    f1edca0d6464b76bc4956352571d8941c02d2c4e

  • SHA256

    fd03dd58aa7cb5236f4df8cde3fb07af304c6f402cd48b86eefcecb8e7b86883

  • SHA512

    f6dc462194037a5c4e0b186088f1fd75befe4cb88bf1dcc7477987951332fc18f8aa66389d567e01677990b022fea6849a66a24510027794e12e2a517edde8d0

  • SSDEEP

    24576:SkMiDApH5iholXZFFqn14hhzk8wncu0Z9Ml+5PkjyDs5U2cuC:tApsolXTF8mhC1c9WCkjMs5Uq

Malware Config

Signatures

  • Troldesh, Shade, Encoder.858

    Troldesh is a ransomware spread by malspam.

  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 64 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates connected drives 3 TTPs 3 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 26 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Interacts with shadow copies 2 TTPs 3 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Modifies registry class 32 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 55 IoCs
  • Suspicious use of FindShellTrayWindow 52 IoCs
  • Suspicious use of SendNotifyMessage 25 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\inf.exe
    "C:\Users\Admin\AppData\Local\Temp\inf.exe"
    1⤵
    • Adds Run key to start application
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1844
    • C:\Windows\system32\vssadmin.exe
      C:\Windows\system32\vssadmin.exe List Shadows
      2⤵
      • Interacts with shadow copies
      PID:3104
    • C:\Windows\system32\vssadmin.exe
      C:\Windows\system32\vssadmin.exe Delete Shadows /All /Quiet
      2⤵
      • Interacts with shadow copies
      PID:2460
    • C:\Windows\system32\vssadmin.exe
      C:\Windows\system32\vssadmin.exe List Shadows
      2⤵
      • Interacts with shadow copies
      PID:1156
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:3416
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Modifies Installed Components in the registry
    • Enumerates connected drives
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:3192
  • C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
    1⤵
    • Drops file in Windows directory
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4888

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\System32\xfs

    Filesize

    241KB

    MD5

    9c73e7afc5fd1ae6a4e6b5f4fdef7e87

    SHA1

    b609db219b61ddd48908a2a54c8e644abcd55100

    SHA256

    6612203e88f7c8a2d27592a923d26304d12bdb613d6f99b4226a03c2e9dff579

    SHA512

    507ca651406ed8ecf52d97fa763698349e5141f5e7b27b5d4bbb06563c42d9284c5ca07d4d924cd464a835d14ec47bfa0f203c3c368d1b30127150efebaa34d9

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db

    Filesize

    1024KB

    MD5

    c54cde3ceede65db57e1ef09429038d6

    SHA1

    d40df43ca2538ba8f23eb8d5e6ba48c6cd1a29a7

    SHA256

    80a0bcaaf774d79edb86f7cf3793bb8d584f3b74a67112b7b7b651aa762240eb

    SHA512

    1677ee5d05e7357550bf0b45d5f077557e3835d066ac930692112c69c4719a4f618af33f8531b9b99f202d3e69716e2f53faa7da0c8092ffa22a43b585777f2b

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db

    Filesize

    1024KB

    MD5

    7cdcbb090eff8689900ebf20abf626a2

    SHA1

    49fa82769220943770ef8e017796314cec23c754

    SHA256

    f0da96d0f11b60e0e9b8f7d8c13b5c30e88a67c8e6146766a87df4f31650f824

    SHA512

    be13a7f17774a8f65de033e9b185352d4e6d08cf267c4e128ecc3cab9484f00259f126121a90d550104734235874d20f4e62308f4b141fe9099427ebeded4b1b

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db

    Filesize

    7KB

    MD5

    53a1264b64e3b5b0d8f3c913e97524e2

    SHA1

    85a684869f8721cb327cf7f6fb3ce8f2b39e80e9

    SHA256

    9353985c11ae4085208fcd8527fe754bf3feda7bc1c93efe0ba0bcf98f37594a

    SHA512

    c50ee6e14cae24769d211e46bebd7bebfc684132baa1f67930434709505acbd1b74885efc28acd8c3c43885f12599e135594dcca89c96ccbd6b7a11689da945a

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db

    Filesize

    7KB

    MD5

    6477badbd5a119a255a7f8ec3faa18c3

    SHA1

    60c4ab1659ec5600feac9ff2d761f6cbc4d4bfe9

    SHA256

    4fe41786c5ca48edb4c8be704de6213f6badec8c8d0b83c1717ddc2df2660107

    SHA512

    488ed10ce72638e6f501224e99500e1704d732f4745bb56cbab327a34c794c951951f43de0b309bdf8081f0ea4525a46108ffaf6a33496b3b68d2dd3e756bb10

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_16.db

    Filesize

    1024KB

    MD5

    eba4e0b01ffe34626b5e200d18741b66

    SHA1

    1b5c320a0d0df24fa823d3e7d089e25a0db6a0a5

    SHA256

    ff580f5b35bf1846a5250e56ee820d7fa1c7adb54784562da5907ee0d896d438

    SHA512

    909910ec8fd0041f61935533779c4c0dbf4848b4a1d688cb1c37139cfdcaef3b3e49f7e747fd015efa0da4446de7b9098bdb5724fc683fc52e634b6daa2f45db

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_256.db

    Filesize

    1024KB

    MD5

    ce0d2afd8b54d0da80987eebdf4bbc2b

    SHA1

    a62bcce695ade2c1b82e069d64c1956e794ce41c

    SHA256

    92f33b17c339256906c34ce8b410ab251de751010761d70a36821a0bd658442b

    SHA512

    85cf9dc4e91ba974e23341155ef2ca2970c4e4f4dc4fb25b38bb0224697c5077388b8d9bd96df3fe3b66a859486ae00d7d393903ada0304bf7d2dbfdb7395d5d

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_48.db

    Filesize

    24B

    MD5

    ae6fbded57f9f7d048b95468ddee47ca

    SHA1

    c4473ea845be2fb5d28a61efd72f19d74d5fc82e

    SHA256

    d3c9d1ff7b54b653c6a1125cac49f52070338a2dd271817bba8853e99c0f33a9

    SHA512

    f119d5ad9162f0f5d376e03a9ea15e30658780e18dd86e81812dda8ddf59addd1daa0706b2f5486df8f17429c2c60aa05d4f041a2082fd2ec6ea8cc9469fade3

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db

    Filesize

    7KB

    MD5

    834ea5b8eae0cc502fffec8ed6ff4b7c

    SHA1

    c5b4e9d46caa0fc37d75aefbf51dc645b5c71fd4

    SHA256

    8c32b3ae58dea844c66d3b1a76ea614c55f71a08bc6f223e73ceb6457855a674

    SHA512

    51d2604b87a39b1cb90692332d9b88ea15d4970a36c8d1c8646b1cf3ec9737bd71a12d66a27ae3087d43289969a939042bc389a4b5875ca3ddb2a087ccac80ff

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db

    Filesize

    7KB

    MD5

    0bda979f4bf29a9dedf549f9b3cb3054

    SHA1

    9123d293094d22ceb7a36e5e436a867418cc8970

    SHA256

    ee8743ee4a95041ad26013063fb5b406b4da2666945d342194009437005a725d

    SHA512

    8268ee0ca133789d4da2c6fbcef401d5ec1b454d0102b65a4ef7f7a2834b52033e39adaa9da612ac17df6cbff51eb368aa586bcddbb3f8311263a29d37352e6e

  • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\MOQY2KJ2\microsoft.windows[1].xml

    Filesize

    97B

    MD5

    b4903288a821aa64b6d398346cc1cedf

    SHA1

    72a2196f0022be4192049e549921f3ffb55532a0

    SHA256

    073ef9b34e4aa7e62e84bfd119b1fbaff3bc34148fab61b82d1f9f98cec1199a

    SHA512

    8f76c8df081644829e6ea8a13897ec65ae8051391a1df9641f96452bbe9a538d129ea6d5b36e4b4fdb8b121392e602c15bc202ba87f78e107cad4e5a53f4b094

  • C:\Users\Admin\AppData\Roaming\D8CAB297D8CAB297.bmp

    Filesize

    2.6MB

    MD5

    993cc909a89f0fb7fe90acc3703c2105

    SHA1

    f422cdcb426718b235a19080b0daf71c9b448768

    SHA256

    4aa6cdb9ce95410f85a05b21967d224cfd49cf8c7fa18d9998304a16d4e4b5d8

    SHA512

    5ec562b1e6f91f8774bf8fd00a6a413b4b4b5be2ede17ff9c417fce7097b7d313b136740e525c19a77f220e80fb0e92f8f4d1866ea185c9fc6755c3b41aa9762

  • memory/1844-39-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/1844-46-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/1844-13-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/1844-14-0x0000000000890000-0x0000000000965000-memory.dmp

    Filesize

    852KB

  • memory/1844-15-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/1844-16-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/1844-17-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/1844-20-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/1844-21-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/1844-22-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/1844-23-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/1844-24-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/1844-25-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/1844-26-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/1844-27-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/1844-28-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/1844-29-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/1844-30-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/1844-31-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/1844-32-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/1844-33-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/1844-34-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/1844-35-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/1844-36-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/1844-37-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/1844-38-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/1844-11-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/1844-40-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/1844-41-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/1844-42-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/1844-43-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/1844-44-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/1844-45-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/1844-12-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/1844-47-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/1844-48-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/1844-49-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/1844-50-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/1844-51-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/1844-52-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/1844-53-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/1844-54-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/1844-55-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/1844-56-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/1844-57-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/1844-58-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/1844-59-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/1844-60-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/1844-61-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/1844-62-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/1844-63-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/1844-64-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/1844-65-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/1844-66-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/1844-7-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/1844-6-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/1844-4-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/1844-3-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/1844-2-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/1844-1-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/1844-0-0x0000000000890000-0x0000000000965000-memory.dmp

    Filesize

    852KB

  • memory/1844-67-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/1844-68-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/1844-69-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/1844-70-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/1844-71-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB